Frama-C
Frama-C is a plug-in platform for analyzing C programs and checking for bugs.
What Frama-C is
Frama-C is a plug-in platform for analyzing C programs and checking for bugs. Its analyzers share a kernel, program representation, and ACSL specification language, allowing results to be combined in sequence or in parallel. Eva applies abstract interpretation to identify supported possible runtime errors, such as invalid memory access and integer overflow, but it analyzes sequential code and does not support recursive calls. WP uses ACSL contracts and weakest-precondition reasoning to check functional correctness across possible executions, relying on external provers or proof assistants. E-ACSL turns executable annotations into C code for runtime checks, although some ACSL constructs cannot be translated. Frama-C is free, self-hosted software for Linux, macOS, and Windows, available under the LGPL with dual licensing possible for other uses. Its main distribution includes Eva, WP, E-ACSL, and other analyzers; some specialized plug-ins are separate or proprietary. It is used in teaching, research, and industrial applications, including safety- and security-critical work.
Good
- Free software for Linux, macOS, and Windows.
- Eva reports supported possible runtime errors.
- WP checks ACSL contracts across possible executions.
- Analyzers can combine results sequentially or in parallel.
- Plug-ins can add or modify analyses.
Watch out
- Eva analyzes sequential code only.
- Eva does not support recursive calls.
- E-ACSL cannot translate every ACSL construct.
- Some specialized plug-ins are separate or proprietary.
Who it suits
Frama-C may suit C developers, educators, and researchers who need static analysis or formal verification. Its intended uses also include industrial work on safety- and security-critical software.
Verdict
Frama-C brings several C-analysis approaches together around ACSL, from possible runtime-error detection to contract verification and runtime checks. Check the limits of the specific analyzer and plug-ins you need before choosing it.
The facts
Each one read from Frama-C's own pages, with the date it was checked.
What it does
- ACSL
- Frama-C uses ACSL annotations to specify function contracts and verify conformance to functional specifications.checked 3 Oct 2026
- Additional analyzers
- The main distribution includes Eva, WP, E-ACSL, and other plug-ins; some specialized plug-ins are proprietary, separately distributed, archived, or have limited support.checked 4 Oct 2026
- Architecture
- Plug-ins share a kernel, program representation, and ACSL specification language, allowing analyzers to combine results sequentially or in parallel.checked 4 Oct 2026
- Audience
- The site describes use in teaching, experimental research, and industrial applications, including safety- and security-critical software.checked 4 Oct 2026
- Eva analysis
- Eva uses abstract interpretation to analyze C programs and report possible runtime errors within the undefined behaviors supported by its analysis.checked 3 Oct 2026
- Eva limits
- Eva currently does not support recursive calls and analyzes only sequential code.checked 3 Oct 2026
- Extensibility
- The platform supports development of plug-ins that add analyses or modify existing ones.checked 4 Oct 2026
- Formal methods
- The platform combines formal-methods-based analyses, most of which the site describes as sound.checked 4 Oct 2026
- Functional verification
- The WP plug-in uses ACSL specifications and weakest-precondition reasoning to prove functional correctness, with SMT solvers and user-provided annotations.checked 4 Oct 2026
- Integrations
- WP uses SMT solvers including Alt-Ergo, CVC5, and Z3.checked 4 Oct 2026
- Intended users
- The site describes Frama-C as used in teaching, experimental research, and industrial applications, including certification work for DO-178, IEC 60880, and Common Criteria EAL 6–7.checked 3 Oct 2026
- Licensing
- Frama-C is available under LGPL and can be dual-licensed for other uses.checked 3 Oct 2026
- Plugin ecosystem
- The plugin catalog lists Eva, WP, E-ACSL, and other analyzers in the main distribution, alongside separately distributed and proprietary plugins.checked 3 Oct 2026
- Purpose
- Frama-C is a framework for modular analysis of C programs using collaborative program analysis plug-ins.checked 4 Oct 2026
- Runtime checking
- E-ACSL translates executable ACSL annotations into C code for runtime checking, but only supports an executable subset of ACSL.checked 4 Oct 2026
- Runtime errors
- The Eva plug-in uses abstract interpretation to analyze possible program behaviors and report supported undefined behaviors, including invalid memory accesses and integer overflows.checked 4 Oct 2026
- Security use
- The site says Frama-C has been used for certification purposes including DO-178, IEC 60880, and Common Criteria EAL 6-7.checked 4 Oct 2026
- Support
- The project offers technical support, training, tutorial sessions, hackathons, extensions, and customization for commercial or industrial use.checked 4 Oct 2026
- WP integrations
- WP recommends Alt-Ergo, Coq, Z3, and CVC4, and supports other provers available through Why3.checked 3 Oct 2026
- WP proofs
- WP checks whether ACSL contracts hold for all possible executions using weakest-precondition calculus and external provers or proof assistants.checked 3 Oct 2026
The company
- Maker
- The platform is co-developed at CEA LIST and the Inria Saclay–Île-de-France Toccata team, in common with LRI-CNRS and Université Paris-Sud 11.checked 3 Oct 2026
Where it runs
- Platforms
- The current download page provides installation instructions for Linux and macOS, and describes Windows use through WSL.checked 4 Oct 2026
Alternatives to Frama-C
- 1
Semgrep Code
Free planOpen sourceWebAPIExtensionLinux8.3From $15 a month - 2
Qodana
Free planWebAPIExtensionLinux7.9From $5 a month - 3
GitHub CodeQL
Free planWebExtensionLinuxmacOS7.5From $30 a month - 4
Understand
APIExtensionLinuxmacOS7.2From $100 a month - 5
Infer
Free planWebLinuxmacOSSelf-hosted6.7Free plan - 6
CBMC
Free planLinuxmacOSWindows6.5Free plan